@yielded/auth-persistence 0.1.0-beta.25 → 0.1.0-beta.27

package/dist/internal/password-kernel.d.mts

@@ -1,278 +0,0 @@
-import { PersistenceMappingError } from "./mapping-error.mjs";
-import { NativeDatabase } from "./transaction-kernel.mjs";
-import { QueryFailure, QueryOperations, SqlColumn, SqlFragment } from "./query-operations.mjs";
-import { AnyPasswordPersistenceMapping } from "./models/password-model.mjs";
-import { CurrentProofSql, ProofSqlConfiguration, makeProofKernel } from "./proof-kernel.mjs";
-import { NativeSqlTables } from "./native-sql-table.mjs";
-import { samePasswordCredentialSnapshot } from "./password-credentials.mjs";
-import { Context, DateTime, Effect, Option, Redacted } from "effect";
-import { CurrentCommitJournal, HookConfigurationError, LifecycleHooks, PreparedCommit } from "@yielded/auth/Hooks";
-import { AuthenticationEvidence, AuthenticationRequirement, SecurityRevision } from "@yielded/auth/Sessions";
-import { ProofCompletionInput, ProofCompletionPlan } from "@yielded/auth/Proofs";
-import { PasswordMutationDecision, PasswordMutationInput, PasswordUnavailable } from "@yielded/auth/Password";
-import { LoginIdentifier } from "@yielded/auth/Identity";
-import { SqlClient } from "effect/sql/SqlClient";
-import * as SqlError$1 from "effect/sql/SqlError";
-//#region src/internal/password-kernel.d.ts
-type AdapterFailure = QueryFailure | PersistenceMappingError | SqlError$1.SqlError;
-export interface PasswordSqlQuery<A = ReadonlyArray<any>> extends Effect.Effect<A, AdapterFailure> {
-  readonly getSQL: () => ReturnType<QueryOperations["sql"]>;
-  readonly from: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly where: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly limit: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly orderBy: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly for: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly set: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly values: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly returning: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly $returningId: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly onConflictDoNothing: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-  readonly onDuplicateKeyUpdate: (...args: ReadonlyArray<any>) => PasswordSqlQuery<A>;
-}
-export interface PasswordSqlDatabase {
-  readonly select: (...args: ReadonlyArray<any>) => PasswordSqlQuery;
-  readonly insert: (...args: ReadonlyArray<any>) => PasswordSqlQuery;
-  readonly update: (...args: ReadonlyArray<any>) => PasswordSqlQuery;
-  readonly delete: (...args: ReadonlyArray<any>) => PasswordSqlQuery;
-  readonly transaction: <A, E, R>(body: (transaction: PasswordSqlDatabase) => Effect.Effect<A, E, R>) => Effect.Effect<A, E | SqlError$1.SqlError, R>;
-}
-declare const CurrentPasswordSql_base: Context.ServiceClass<CurrentPasswordSql, "effect-auth/CurrentPasswordSql", PasswordSqlDatabase>;
-export declare class CurrentPasswordSql extends CurrentPasswordSql_base {}
-export interface PasswordSqlConfiguration {
-  readonly mode: "interactive" | "synchronous";
-  readonly locking: boolean;
-  readonly standaloneGuard: Effect.Effect<void, PasswordUnavailable>;
-  readonly coordinated?: boolean;
-  readonly insertIfAbsent: (query: PasswordSqlQuery, selfKey: string, selfValue: unknown) => PasswordSqlQuery;
-  readonly proof?: {
-    readonly mapping: any;
-    readonly configuration: ProofSqlConfiguration;
-  };
-}
-type Database = PasswordSqlDatabase;
-export declare const makePasswordKernel: <Fragment extends SqlFragment = SqlFragment, Column extends SqlColumn = SqlColumn>(operations: QueryOperations<Fragment, Column>, proofs: Pick<ReturnType<typeof makeProofKernel>, "completeProofPlanIn">, nativeTables?: (client: SqlClient, database: object) => NativeSqlTables) => {
-  makeSqlPasswordPersistence: (mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration) => Effect.Effect<{
-    readonly findCredential: (input: {
-      readonly moduleId: string;
-      readonly identifier: LoginIdentifier;
-      readonly subjectId?: import("@yielded/auth/Schema").SubjectId;
-    }) => Effect.Effect<Option.Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
-    readonly rehashIfCurrent: (input: {
-      readonly credential: import("@yielded/auth/Password").PasswordCredentialSnapshot;
-      readonly nextVerifier: Redacted.Redacted<import("@yielded/auth/Password").EncodedPasswordHash>;
-    }) => Effect.Effect<void, PasswordUnavailable>;
-    readonly readForSubject: (input: {
-      readonly moduleId: string;
-      readonly subjectId: import("@yielded/auth/Schema").SubjectId;
-    }) => Effect.Effect<Option.Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
-    readonly recoveryTarget: (input: {
-      readonly moduleId: string;
-      readonly identifier: LoginIdentifier;
-    }) => Effect.Effect<Option.Option<import("@yielded/auth/Password").PasswordCredentialSnapshot>, PasswordUnavailable>;
-    readonly addIfAbsent: <A>(input: PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
-    readonly replaceIfCurrent: <A>(input: PasswordMutationInput, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
-    readonly checkReset: (input: ProofCompletionInput) => Effect.Effect<boolean, PasswordUnavailable>;
-    readonly resetWithProof: <A>(input: PasswordMutationInput & {
-      readonly completion: ProofCompletionPlan;
-    }, prepare: import("@yielded/auth/Password").PreparePasswordCommit<PasswordMutationDecision, A>) => Effect.Effect<PreparedCommit<A>, PasswordUnavailable>;
-  }, PasswordUnavailable, CurrentPasswordSql | LifecycleHooks | NativeDatabase>;
-  passwordSqlKernel: {
-    allocate: <A>(mode: PasswordSqlConfiguration["mode"], asyncValue: Effect.Effect<A, PersistenceMappingError> | undefined, syncValue: (() => A) | undefined) => Effect.Effect<A, PasswordUnavailable | PersistenceMappingError>;
-    allocateNextSecurityRevision: (mapping: AnyPasswordPersistenceMapping<Fragment>, mode: PasswordSqlConfiguration["mode"], current: SecurityRevision) => Effect.Effect<string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">, PasswordUnavailable | PersistenceMappingError, never>;
-    owned: <A, E, R>(database: Database, mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration, body: Effect.Effect<A, E, R>) => Effect.Effect<A, E | HookConfigurationError | PasswordUnavailable | SqlError$1.SqlError, LifecycleHooks | Exclude<Exclude<Exclude<R, CurrentPasswordSql>, CurrentProofSql>, CurrentCommitJournal>>;
-    safeRead: <A, E, R>(database: Database, configuration: PasswordSqlConfiguration, body: Effect.Effect<A, E, R>) => Effect.Effect<A, E | PasswordUnavailable | SqlError$1.SqlError, Exclude<Exclude<R, CurrentPasswordSql>, CurrentProofSql>>;
-    snapshotMutationInput: (input: PasswordMutationInput) => Effect.Effect<Readonly<{
-      moduleId: string;
-      commandId: import("@yielded/auth/Password").PasswordCommandId;
-      credential?: Readonly<{
-        moduleId: string;
-        credentialId: string;
-        credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
-        normalization: "NFC" | "none";
-        identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        identifierVerifiedAtMillis?: number;
-        revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
-        };
-        identifier: Readonly<LoginIdentifier>;
-      }>;
-      expectedRevision: {
-        readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-        readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        readonly credentials: readonly {
-          readonly credentialId: string;
-          readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        }[];
-      };
-      replacement: Readonly<{
-        verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
-        normalization: "NFC" | "none";
-      }>;
-      invalidation: Readonly<{
-        trigger: "all-session-revocation" | "credential-change" | "factor-reset" | "identifier-change" | "password-reset" | "subject-delete" | "subject-disable";
-        existingSessions: "cache-expiry" | "immediate" | "original-absolute-expiry";
-        maximumExposureMillis: number;
-        oldAuthenticationEvidence: "rejected";
-      }>;
-      authorization: Readonly<{
-        challenge: Readonly<{
-          moduleId: string;
-          action: "add-password" | "change-password" | "reset-password";
-          commandId: string & import("effect/Brand").Brand<"effect-auth/PasswordCommandId">;
-          targetCredentialId?: string;
-          bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          revision: {
-            readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            readonly credentials: readonly {
-              readonly credentialId: string;
-              readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            }[];
-          };
-        }>;
-        evidence: Readonly<{
-          flowId: string & import("effect/Brand").Brand<"effect-auth/AuthenticationFlowId">;
-          bindingDigest: string & import("effect/Brand").Brand<"effect-auth/TokenDigest">;
-          revision: Readonly<{
-            subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-            securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            credentials: readonly Readonly<{
-              credentialId: string;
-              revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-            }>[];
-          }>;
-          proofs: readonly [Readonly<{
-            method: string;
-            credentialId: string;
-            userVerified: boolean;
-            phishingResistant: boolean;
-            factors: readonly ("inherence" | "knowledge" | "possession")[];
-            verifiedAt: DateTime.Utc;
-          }>, ...Readonly<{
-            method: string;
-            credentialId: string;
-            userVerified: boolean;
-            phishingResistant: boolean;
-            factors: readonly ("inherence" | "knowledge" | "possession")[];
-            verifiedAt: DateTime.Utc;
-          }>[]];
-        }>;
-        requirement: Readonly<{
-          maximumAgeMillis: number;
-          alternatives: readonly [Readonly<{
-            userVerified: boolean;
-            phishingResistant: boolean;
-            minimumCredentials: number;
-            factors: readonly ("inherence" | "knowledge" | "possession")[];
-          }>, ...Readonly<{
-            userVerified: boolean;
-            phishingResistant: boolean;
-            minimumCredentials: number;
-            factors: readonly ("inherence" | "knowledge" | "possession")[];
-          }>[]];
-        }>;
-      }>;
-    }>, PasswordUnavailable, never>;
-    lockSubject: (mapping: AnyPasswordPersistenceMapping<Fragment>, subjectId: string, locking: boolean) => Effect.Effect<{
-      nativeSubjectId: unknown;
-      row: any;
-    }, AdapterFailure, CurrentPasswordSql>;
-    lockIdentifier: (mapping: AnyPasswordPersistenceMapping<Fragment>, identifier: LoginIdentifier, locking: boolean) => Effect.Effect<readonly any[], AdapterFailure, CurrentPasswordSql>;
-    readPasswordCredential: (mapping: AnyPasswordPersistenceMapping<Fragment>, moduleId: string, nativeSubjectId: unknown, locking: boolean) => Effect.Effect<readonly any[], AdapterFailure, CurrentPasswordSql>;
-    resolveCredential: (mapping: AnyPasswordPersistenceMapping<Fragment>, moduleId: string, identifier: LoginIdentifier, requestedSubjectId: string | undefined, locking: boolean) => Effect.Effect<{
-      nativeSubjectId: any;
-      subject: any;
-      identifier: any;
-      snapshot?: never;
-      readonly credential?: never;
-    } | {
-      nativeSubjectId: any;
-      subject: any;
-      identifier: any;
-      credential: any;
-      snapshot: Readonly<{
-        moduleId: string;
-        credentialId: string;
-        credentialRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        verifierVersion: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        verifier: Redacted.Redacted<string & import("effect/Brand").Brand<"effect-auth/EncodedPasswordHash">>;
-        normalization: "NFC" | "none";
-        identifierBindingRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-        identifierVerifiedAtMillis?: number;
-        revision: {
-          readonly subjectId: string & import("effect/Brand").Brand<"effect-auth/SubjectId">;
-          readonly securityRevision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          readonly credentials: readonly {
-            readonly credentialId: string;
-            readonly revision: string & import("effect/Brand").Brand<"effect-auth/SecurityRevision">;
-          }[];
-        };
-        identifier: Readonly<LoginIdentifier>;
-      }>;
-    } | undefined, PasswordUnavailable | QueryFailure, CurrentPasswordSql>;
-    validateMutationAuthority: (mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration, input: PasswordMutationInput, action: "add-password" | "change-password" | "reset-password") => Effect.Effect<{
-      nativeSubjectId: unknown;
-      row: any;
-      now: number;
-    } | undefined, AdapterFailure, CurrentPasswordSql>;
-    currentExpectedCredential: (mapping: AnyPasswordPersistenceMapping<Fragment>, input: PasswordMutationInput, nativeSubjectId: unknown) => Effect.Effect<boolean, AdapterFailure, CurrentPasswordSql>;
-    commandExists: (mapping: AnyPasswordPersistenceMapping<Fragment>, moduleId: string, commandId: string, locking: boolean) => Effect.Effect<readonly any[], AdapterFailure, CurrentPasswordSql>;
-    addPasswordIn: (mapping: AnyPasswordPersistenceMapping<Fragment>, configuration: PasswordSqlConfiguration, input: PasswordMutationInput, revisions: {
-      readonly credentialId: string;
-      readonly credentialRevision: SecurityRevision;
-      readonly verifierVersion: SecurityRevision;
-      readonly nextSecurityRevision: SecurityRevision;
-    }, commandNow?: number | undefined) => Effect.Effect<boolean, PasswordUnavailable | QueryFailure, CurrentPasswordSql>;
-    checkMutationApplied: (mapping: AnyPasswordPersistenceMapping<Fragment>, input: PasswordMutationInput, nativeSubjectId: unknown, revisions: {
-      readonly credentialId: string;
-      readonly credentialRevision: SecurityRevision;
-      readonly verifierVersion: SecurityRevision;
-      readonly nextSecurityRevision: SecurityRevision;
-    }, now: number) => Effect.Effect<boolean, AdapterFailure, CurrentPasswordSql>;
-    writeReplacement: (mapping: AnyPasswordPersistenceMapping<Fragment>, input: PasswordMutationInput, nativeSubjectId: unknown, revisions: {
-      readonly credentialRevision: SecurityRevision;
-      readonly verifierVersion: SecurityRevision;
-      readonly nextSecurityRevision: SecurityRevision;
-    }, now: number) => Effect.Effect<boolean, AdapterFailure, CurrentPasswordSql>;
-    evidenceSatisfiedAt: (evidence: AuthenticationEvidence, requirement: AuthenticationRequirement, now: number) => boolean;
-    sameCredentialSnapshot: typeof samePasswordCredentialSnapshot;
-    subjectColumns: (mapping: AnyPasswordPersistenceMapping<Fragment>) => {
-      id: Column;
-      status: Column;
-      securityRevision: Column;
-    };
-    identifierColumns: (mapping: AnyPasswordPersistenceMapping<Fragment>) => {
-      namespace: Column;
-      value: Column;
-      subjectId: Column;
-      verifiedAt: Column;
-      bindingRevision: Column;
-    };
-    credentialColumns: (mapping: AnyPasswordPersistenceMapping<Fragment>) => {
-      moduleId: Column;
-      subjectId: Column;
-      credentialId: Column;
-      credentialRevision: Column;
-      verifierVersion: Column;
-      verifier: Column;
-      normalization: Column;
-    };
-    authorityCredentialColumns: (mapping: AnyPasswordPersistenceMapping<Fragment>) => {
-      subjectId: Column;
-      credentialId: Column;
-      revision: Column;
-    };
-    proofCompletionMatchesPassword: (input: PasswordMutationInput & {
-      readonly completion: ProofCompletionPlan;
-    }) => boolean;
-  };
-};
-//#endregion
-//# sourceMappingURL=password-kernel.d.mts.map